Extracted

• • Target

    tmp

  • Size

    97KB

  • MD5

    95e03ae51a6671e98b8461dc1ad766eb

  • SHA1

    3968a825dbda1b2998f89018c163a5e16fbdc3f3

  • SHA256

    23f70436d5d45e4abfd9763a73a43637a51192bb1ad95df790b6ebb3dd4060d1

  • SHA512

    bd12655eb446251a76ddf49a68efadaa30f13cf905323dac0992a652679e745cad881e72df95b63c26b833cf2c5a7c51f8aa10da90291843a24a9b4180e4da26

  • SSDEEP

    1536:fEzhNlLbVUKs23ZS0M5Gw/B4dIR/2rS4eCurntMJI8MY4:8z5LbVUz2RM5GfrS4eC6teIHB

  Score

  10^/10

  redlinemix-3discoveryinfostealerspywarestealer

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2